From 3ccfc17c12c2e4d318f6e699df9f34b88769fd7c Mon Sep 17 00:00:00 2001 From: Julian Maurice Date: Tue, 10 Jun 2014 12:47:37 +0200 Subject: [PATCH] Bug 12398: Fix CAS authentication validation CGI::url_param() also returns deleted parameters so we have to check with CGI::param() too. --- C4/Auth_with_cas.pm | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/C4/Auth_with_cas.pm b/C4/Auth_with_cas.pm index 69e510f..17e43e4 100644 --- a/C4/Auth_with_cas.pm +++ b/C4/Auth_with_cas.pm @@ -203,9 +203,13 @@ sub _url_with_get_params { my $uri_base_part = C4::Context->preference('OPACBaseURL') . $query->script_name(); my $uri_params_part = ''; foreach ( $query->url_param() ) { - $uri_params_part .= '&' if $uri_params_part; - $uri_params_part .= $_ . '='; - $uri_params_part .= URI::Escape::uri_escape( $query->url_param($_) ); + # url_param() always returns parameters that were deleted by delete() + # This additional check ensure that parameter was not deleted. + if ($query->param($_)) { + $uri_params_part .= '&' if $uri_params_part; + $uri_params_part .= $_ . '='; + $uri_params_part .= URI::Escape::uri_escape( $query->param($_) ); + } } $uri_base_part .= '?' if $uri_params_part; -- 1.7.10.4